How to use it:

1. Download GotRoot rules from www.GotRoot.com and save it in your /tmp file.
2. Save the script in its own folder and make the script executable (chmod u+x)
3. At running time the script will ask you for the file version, nothing else, then it will do everything automatically for you.
   So, for example, if the rule file is called modsec-201001121214.tar.gz, you will have to write "201001121214".
   The script will test Apache to check everything was fine, if it is, you could restart apache from there or do it later manually.
4. The script will save a backup with your actual rules before it does the update, if Apache gives any error, you can manually restore everything on its place.
5. Read any text inside the file for any last minute config or update.

How the script works:

1. The script checks that the rule file is already saved on the /tmp directory.
2. It unpacks everything in a temporary folder.
3. Modifies some rules to be 100% compatible with CPanel.
4. Saves the actual rules in a directory, just in case needed to do a manual restore.
5. Replaces all the modsec_rule files with the new ones.
6. Checks that Apache runs with the new rules.
7. AutoUpdater now reverts changes made when Apache fails (read Comment 5).
8. Deletes all the temporary files used.
9. The script ends.

The use of this script is at your own risk and we don't assume any responsibility.

ENJOY IT!

REQUIREMENTS:

In order for the ModSec Rules from GotRoot or ASL to work, you NEED to have the files MODSEC2.CONF and MODSEC2.USER.CONF configured as follows:

MODSEC2.CONF:
This is the default configuration file used by CPanel, don't write anything
in here EasyApache will save the default configuration every time it is used.

LoadFile /opt/xml2/lib/libxml2.so
LoadFile /opt/lua/lib/liblua.so
LoadModule security2_module  modules/mod_security2.so

SecRuleEngine On
# See http://www.modsecurity.org/documentation/ModSecurity-Migration-Matrix.pdf
#  "Add the rules that will do exactly the same as the directives"
# SecFilterCheckURLEncoding On
# SecFilterForceByteRange 0 255
SecAuditEngine RelevantOnly
SecAuditLog logs/modsec_audit.log
SecDebugLog logs/modsec_debug_log
SecDebugLogLevel 0
SecDefaultAction "phase:2,deny,log,status:406"
SecRule REMOTE_ADDR "^127.0.0.1$" nolog,allow
Include "/usr/local/apache/conf/modsec2.user.conf"

MODSEC2.USER.CONF:
This is the file where you can write anything that you want that ModSec rules do.
If you are using GotRoot or ASL rules, this is how you need to set it.

SecComponentSignature 201205101758
SecRequestBodyAccess On
SecResponseBodyAccess On
SecResponseBodyMimeType (null) text/html text/plain text/xml
SecResponseBodyLimit 2621440
SecServerSignature Apache
SecUploadDir /var/asl/data/suspicious
SecUploadKeepFiles Off
SecAuditLogParts ABIFHZ
SecArgumentSeparator "&"
SecCookieFormat 0
SecRequestBodyInMemoryLimit 131072
SecDataDir /var/asl/data/msa
SecTmpDir /tmp
SecAuditLogStorageDir /var/asl/data/audit
SecResponseBodyLimitAction ProcessPartial

# USE THE FOLLOWING TWO COMMANDS ONLY IF YOU HAVE MOD_SEC 2.6.X or better
# SecPcreMatchLimit 50000
# SecPcreMatchLimitRecursion 5000
 
# ConfigServer ModSecurity whitelist file remove the mark if you are using ConfigServer CMC.
# Include /usr/local/apache/conf/modsec2.whitelist.conf

#ASL Rules
Include /usr/local/apache/conf/modsec_rules/*asl*.conf